1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3

Analysis

max time kernel
178s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
Size

1.6MB
MD5

e41bc59444368b58490c2b42f093df6a
SHA1

85a845513bcda26ccab0c5bdab21c18fcde4dcec
SHA256

1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3
SHA512

22cec34d8f2a6e9b5f3fb3e7610ecd4bef6cb55dded497824981edaf0d98bb30cba8bd5c45ddf0dcd5b1d57e4f84e2e78b5ba41b31f4c95e72bbec72b089926f
SSDEEP

24576:BzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYZ:T6/ye0PIphrp9Zuvjqa0Uidi

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe

description	pid	process	target process
PID 1128 set thread context of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe

pid	process
4868	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
4868	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
4868	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
4868	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
4868	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe

description	pid	process	target process
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
PID 1128 wrote to memory of 4868	1128	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe	1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe

C:\Users\Admin\AppData\Local\Temp\1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
"C:\Users\Admin\AppData\Local\Temp\1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe
  "C:\Users\Admin\AppData\Local\Temp\1d2dbfdbc8e568b341f36b4a74497576ef51e8901b868f49177c0588f3d5ebb3.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4868-132-0x0000000000000000-mapping.dmp

Download
memory/4868-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4868-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4868-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4868-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4868-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4868-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download